okay I had no idea how it happened until I found this article:
http://www.ghacks.net/2011/08/17/how-to-uninstall-the-babylon-toolbar-completely/... so this must have been yesterday, I wanted to download a program to do desktop video capture and that's what you get from Cnet now:
cnet_Pixetell-1_3_16005_zip.exe
... then after running it you get the actual program file you're looking for, downloaded:
in this case Pixetell-1.3.16005.zip
... I'm sure I unchecked any suggested crapware during the Cnet download, but it still happened:
Chrome >>> search engine hijacked
Firefox >>> search engine and homepage hijacked
Internet Explorer 9 >>> search engine, homepage hikacked + toolbar installed (but not enabled, I got a prompt)
Their freakin' homepage imitates Google
... don't what would have happened with Avast, I didn't have it installed anymore for a few days (boottime issues, unrelated here), just MSE was running. But I'm not sure at all if Avast would have prevented anything.